Terraform "reading ...: NoSuchEntity" in CI

Terraform looked up an IAM entity -- via a data source or while refreshing state -- and AWS replied NoSuchEntity because the role, policy, or user does not exist in the account/region being queried.

What this error means

plan/refresh fails with NoSuchEntity naming an IAM entity. It surfaces when a data source points at a role that was deleted or never created, or when state references an entity that no longer exists.

terraform

Error: reading IAM Role (deploy-role): operation error IAM: GetRole,
https response error StatusCode: 404, NoSuchEntity: The role with name
deploy-role cannot be found.

  with data.aws_iam_role.deploy,
  on data.tf line 1, in data "aws_iam_role" "deploy":

Common causes

Entity does not exist

A data source references an IAM role/policy/user that was never created, was deleted, or lives in a different account.

Wrong account or stale state

Querying the wrong account, or refreshing state for an entity deleted out-of-band, yields NoSuchEntity.

How to fix it

Create or reference the correct entity

Manage the entity in Terraform (so it exists before being read), or fix the data-source name to one that exists.

iam.tf

# manage it instead of assuming it exists:
resource "aws_iam_role" "deploy" {
  name = "deploy-role"
  # ...
}
# then reference aws_iam_role.deploy, not a data source

Reconcile state for deleted entities

Confirm the entity exists in the account/region CI targets.
If it was deleted out-of-band, remove the stale reference or terraform state rm the resource.
Verify the data-source name matches the real entity exactly.

How to prevent it

Prefer managed resources over data sources for entities you own.
Confirm the target account/region before reading existing entities.
Reconcile state after out-of-band deletions.